Bug 191897

Summary: DFGSpeculativeJIT should not &= exitOK with mayExit(node)
Product: WebKit Reporter: Saam Barati <sbarati>
Component: JavaScriptCoreAssignee: Saam Barati <sbarati>
Severity: Normal CC: benjamin, commit-queue, fpizlo, ggaren, gskachkov, keith_miller, mark.lam, msaboff, rmorisset, ticaiolima, webkit-bug-importer, ysuzuki
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   
Description Flags
patch none

Description Saam Barati 2018-11-21 15:31:07 PST
It's actually weird that we did this when you think about what each thing means. exitOK is a statement about it being legal to exit. However, mayExit tries to be as smart and use as much information as it can to make a statement about if an exit could happen at runtime when the code executes. It can't return false if a runtime exit *could* happen. However, there is code in the compiler where mayExit() returns false (because it uses data generated from AI about type checks being proved), but the code we emit may unconditionally generate code that emits an exit, even if that exit may never execute. For example, let's say we have this IR:


And we always emit code like this:

jump L1 if input == true
jump L1 if input == false
emit an OSR exit

In such a program, when we generate the above OSR exit, in a validationEnabled() build, and if @input is proved to be a boolean, we'll end up crashing because we have the bogus assertion saying !exitOK. This is one reason why things are cleaner if we don't conflate mayExit() with exitOK.
Comment 1 Saam Barati 2018-11-21 15:31:42 PST
Comment 2 Saam Barati 2018-11-21 15:40:53 PST
Created attachment 355441 [details]
Comment 3 Mark Lam 2018-11-21 16:04:41 PST
Comment on attachment 355441 [details]

Comment 4 WebKit Commit Bot 2018-11-21 19:43:38 PST
Comment on attachment 355441 [details]

Clearing flags on attachment: 355441

Committed r238437: <https://trac.webkit.org/changeset/238437>
Comment 5 WebKit Commit Bot 2018-11-21 19:43:40 PST
All reviewed patches have been landed.  Closing bug.